HCL AppScan on Cloud (ASoC) Connector Guide

Summary: How to set up and use the HCL AppScan on Cloud (ASPM) connector in Ivanti Neurons.

HCL AppScan on Cloud (ASPM) is a SaaS solution for all application security testing needs. It consolidates all HCL Security’s testing capabilities into a single service that provides a uniform experience for all technologies.

The Ivanti Neurons platform provides an API-based connector that integrates with HCL ASPM, allowing customers to bring in their DAST, SAST and Open Source (OSS) findings. It allows customers to gain visibility into their overall risk due to vulnerabilities in their source code and web applications, thereby enabling a simpler, more efficient way to manage those vulnerabilities.

HCL ASPM is a cloud-based solution. Access to the cloud instance with scanning capabilities is a prerequisite.

The user must have view access to applications, scans, and their corresponding issues. Any role above Application Manager (the default role in HCL ASPM) is sufficient for pulling data. Refer to this following link for more information.

The Key ID and Key Secret are used for API authentication.

Log in to the HCL ASPM cloud instance, click on the left hamburger menu, and navigate to the Settings page.

On the Settings page, click Generate to obtain a new Key and Secret for accessing the API endpoints.

Once successfully generated, make sure to copy these values, as you will be unable to retrieve them later.

The following API calls are performed during a connector run to pull vulnerabilities from HCl ASPM into Ivanti Neurons.

Navigate to the Automate > Integrations page.

Using the search bar in the upper-right corner of the Integrations page, type AppScan on Cloud to find the connector. Locate the HCL ASPM card on the page and click Configuration.

In the new window under Connection, complete the required fields, as described below.

Click Test Credentials to verify the credentials are correct and have access to make API calls to the HCL ASPM. Configure the desired schedule for the connector to retrieve results from the HCL ASPM instance and optionally turn on Enable auto URBA (Update Remediation by Assessment).

Click the Save button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the Integrations page under Currently Configured Integrations.

Clicking the History button displays the connector details for each pull. The Sync button allows users to perform an on-demand sync. The Edit button allows the user to edit the connector configuration. The Delete button allows the user to delete the connector.

Once files have been processed on the Uploads page, the user can view the ingested data by navigating to the Applications and Application Findings pages.

This table shows the high-level mapping of HCL ASPM fields in Ivanti Neurons. HCL ASPM connector pulls DAST, SAST, and OSS findings.

The following HCL ASPM fields are converted into Ivanti Neurons tags. These tags are used for searches, playbook automation, and better visualization in Dashboards.

Here are the default values for the following Ivanti Neurons fields as defined for HCL ASPM: